Abstract:Dynamic analysis is a technique that is used to fully understand the internals of a system at runtime. On Android, dynamic security analysis involves real-time assessment and active adaptation of an app's behaviour, and is used for various tasks, including network monitoring, system-call tracing, and taint analysis. The research on dynamic analysis has made significant progress in the past years. However, to the best of our knowledge, there is a lack in secondary studies that analyse the novel ideas and common limitations of current security research. The main aim of this work is to understand dynamic security analysis research on Android to present the current state of knowledge, highlight research gaps, and provide insights into the existing body of work in a structured and systematic manner. We conduct a systematic literature review (SLR) on dynamic security analysis for Android. The systematic review establishes a taxonomy, defines a classification scheme, and explores the impact of advanced Android app testing tools on security solutions in software engineering and security research. The study's key findings centre on tool usage, research objectives, constraints, and trends. Instrumentation and network monitoring tools play a crucial role, with research goals focused on app security, privacy, malware detection, and software testing automation. Identified limitations include code coverage constraints, security-related analysis obstacles, app selection adequacy, and non-deterministic behaviour. Our study results deepen the understanding of dynamic analysis in Android security research by an in-depth review of 43 publications. The study highlights recurring limitations with automated testing tools and concerns about detecting or obstructing dynamic analysis.

Study of the Influence of Anti-analysis Techniques on the Security of Android Ecosystem

PackerGrind: An Adaptive Unpacking System for Android Apps.

Malton: Towards On-Device Non-Invasive Mobile Malware Analysis for ART.

NCScope: Hardware-Assisted Analyzer for Native Code in Android Apps

Parema: an Unpacking Framework for Demystifying VM-based Android Packers.

Happer - Unpacking Android Apps via a Hardware-Assisted Approach.

ARAP: Demystifying Anti Runtime Analysis Code in Android Apps

Hybrid Dynamic Analysis for Android Malware Protected by Anti-Analysis Techniques with DOOLDA

What Did You Pack in My App? a Systematic Analysis of Commercial Android Packers.

A3: Automatic Analysis of Android Malware

Security Analysis for Android Applications Using Sensitive Path Identification

When program analysis meets mobile security: an industrial study of misusing Android internet sockets

Android HIV: A Study of Repackaging Malware for Evading Machine-Learning Detection

Study on the Application of Dalvik Injection Technique for the Detection of Malicious Programs in Android

AnaDroid: Malware Analysis of Android with User-supplied Predicates

Dynamic Security Analysis on Android: A Systematic Literature Review

Analyzing Android Application in Real-Time at Kernel Level

Benchmarking Android Malware Analysis Tools

Design and Implementation of Malware Automated Analysis Tool Based on Behavior Analysis

A DETECTION FRAMEWORK OF CODE-HIDING EVASION TECHNIQUE BASED ON ANDROID SYSTEM

An Informative and Comprehensive Behavioral Characteristics Analysis Methodology of Android Application for Data Security in Brain-Machine Interfacing